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Abstract — Digital fingerprinting is a framework for marking 
media flies, such as images, music, or movies, with user-specific 
signatures to deter illegal distribution. Multiple users can collude 
to produce a forgery that can potentially overcome a finger- 
printing system. This paper proposes an equiangular tight frame 
fingerprint design which is robust to such collusion attacks. We 
motivate this design by considering digital flngerprinting in terms 
of compressed sensing. The attack is modeled as linear averaging 
of multiple marked copies before adding a Gaussian noise vector. 
The content owner can then determine guilt by exploiting corre- 
lation between each user's fingerprint and the forged copy. The 
worst-case error probability of this detection scheme is analyzed 
and bounded. Simulation results demonstrate the average-case 
performance is similar to the performance of orthogonal and 
simplex fingerprint designs, while accommodating several times 
as many users. 

Index Terms — digital flngerprinting, collusion attacks, frames. 



I. Introduction 

DIGITAL media protection has become an important is- 
sue in recent years, as illegal distribution of licensed 
material has become increasingly prevalent. A number of 
methods have been proposed to restrict illegal distribution of 
media and ensure only licensed users are able to access it. 
One method involves cryptographic techniques, which encrypt 
the media before distribution. By doing this, only the users 
with appropriate licensed hardware or software have access; 
satellite TV and DVDs are two such examples. Unfortunately, 
cryptographic approaches are limited in that once the content 
is decrypted (legally or illegally), it can potentially be copied 
and distributed freely. 

An alternate approach involves marking each copy of the 
media with a unique signature. The signature could be a 
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change in the bit sequence of the digital file or some noise-like 
distortion of the media. The unique signatures are called ^n- 
gerprints, by analogy to the uniqueness of human fingerprints. 
With this approach, a licensed user could illegally distribute 
the file, only to be implicated by his fingerprint. The potential 
for prosecution acts as a deterrent to unauthorized distribution. 

Fingerprinting can be an effective technique for inhibiting 
individual hcensed users from distributing their copies of the 
media. However, fingerprinting systems are vulnerable when 
multiple users form a collusion by combining their copies 
to create a forged copy. This attack can reduce and distort 
the colluders' individual fingerprints, making identification of 
any particular user difficult. Some examples of potential at- 
tacks involve comparing the bit sequences of different copies, 
averaging copies in the signal space, as well as introducing 
distortion (such as noise, rotation, or cropping). 

There are two principal approaches to designing fingerprints 
with robustness to collusions. The first approach uses the 
marking assumption that the forged copy only differs 
from the colluders' copies where the colluders' copies are 
different (typically in the bit sequence). In many cases, this is 
a reasonable assumption because modifying other bits would 
likely render the file unusable (such as with software). 

Boneh and Shaw proposed the first known fingerprint design 
that uses the marking assumption to identify a member of 
the collusion with high probability [1|. Boneh and Shaw's 
method incorporates the results of Chor et al., who investigated 
how to detect users who illegally share keys for encrypted 
material |2|. Schaathun later showed that the Boneh-Shaw 
scheme is more efficient than initially thought and proposed 
further improvements |3|. Tardos also proposed a method with 
significantly shorter codelengths than those of the Boneh- 
Shaw procedure |4|. Several recent works investigate the 
relationship between the fingerprinting problem and multiple 
access channels, and they calculate the capacity of a "finger- 
print channel" f5l-f8l. Barg and Kabatiansky also developed 
"parent-identifying" codes under a relaxation of the marking 
assumption |9|, and there have been a number of other works 
developing special classes of binary fingerprinting codes, 
including ||T0)-||l5. 

The second major approach uses the distortion assumption. 
In this regime, fingerprints are noise-like distortions to the 
media in signal space. In order to preserve the overall quality 
of the media, limits are placed on the magnitude of this distor- 
tion. The content owner limits the power of the fingerprint he 
adds, and the collusion limits the power of the noise they add 
in their attack. When applying the distortion assumption, the 
literature typically assumes that the collusion linearly averages 
their individual copies to forge the host signal. Also, while 
results in this domain tend to accommodate fewer users than 
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those with the marking assumption, the distortion assumption 
enables a more natural embedding of the fingerprints, i.e., in 
the signal space. 

Cox et al. introduced one of the first robust fingerprint 
designs under the distortion assumption |16|; the robustness 
was later analytically proven in |17|. Ergun et al. then showed 
that for any fingerprinting system, there is a tradeoff between 
the probabilities of successful detection and false positives 
imposed by a linear-average-plus-noise attack from sufficiently 
large collusions pS) . Specific fingerprint designs were later 
studied, including orthogonal fingerprints [19] and simplex 
fingerprints |20|. There are also some proposed methods mo- 
tivated by CDMA techniques |[2T], ||22). Jourdas and Moulin 
demonstrated that a high rate can be achieved by embed- 
ding randomly concatenated, independent short codes [23 J . 
Kiyavash and Moulin derived a lower bound on the worst- 
case error probabilities for designs with equal-energy finger- 
prints [24] . An error probability analysis of general fingerprint 
designs with unequal priors on user collusion is given in p5) . 
Some works have also investigated fingerprint performance 
under attack strategies other than linear averaging [26 J , [27J 
and under alternative noise models 128) . 

When working with distortion-type fingerprints, some em- 
bedding process is typically needed. This process is intended 
to make it difficult for the coUuders to identify or distort 
fingerprints without significantly damaging the corresponding 
media in the process. For instance, if the identity basis is 
used as an orthogonal fingerprint design, then three or more 
colluders can easily identify and remove their fingerprints 
through comparisons. Indeed, different signal dimensions have 
different perceptual significance to the human user, and one 
should vary signal power strengths accordingly. There is a 
large body of work in this area known as watermarking, 
and this literature is relevant since fingerprinting assigns a 
distinct watermark to each user. As an example, one method 
of fingerprint embedding is known as spread spectrum water- 
marking. Inspired by spread spectrum communications p9] , 
this technique rotates the fingerprint basis to be distributed 
across the perceptually significant dimensions of the sig- 
nal p6) . This makes fingerprint removal difficult while at the 
same time maintaining acceptable fidelity. For an overview of 
watermarking media, see |[30), pT). 

The present paper proposes a fingerprint design under the 
distortion assumption. Specifically, we propose equiangular 
tight frames for fingerprint design and analyze their perfor- 
mance for the worst-case collusion. Moreover, through simu- 
lations, we show that these fingerprints perform comparably 
to orthogonal and simplex fingerprints on average, while 
accommodating several times as many users. Li and Trappe 
p2J also used fingerprints satisfying the Welch bound, but 
did not use tight frames, designed the decoder to return the 
whole collusion, and did not perform worst case analysis. 
Use of compressed sensing for fingerprint design was first 
suggested in |32| and |33|, follow by |34|. However, [34] and 
|j33 1 focused on detection schemes with Gaussian fingerprints. 
Additionally, f35\ examined combinatorial similarities of fin- 
gerprint codes and compressed sensing measurement matrices. 

We present the description of the fingerprinting problem 



in Section |ll] In Section [In] we discuss this problem from a 
compressed sensing viewpoint and introduce the equiangular 
tight frame fingerprint design. Using this design, we consider a 
detector which determines guilt for each user through binary 
hypothesis testing, using the correlation between the forged 
copy and the user's fingerprint as a test statistic. In Section IV 
we derive bounds on the worst-case error probability for this 
detection scheme assuming a linear-average-plus-noise attack. 
Finally in Section |V] we provide simulations that demonstrate 
the average-case performance in comparison to orthogonal and 
simplex fingerprint designs. 

II. Problem Setup 

In this section, we describe the fingerprinting problem and 
discuss the performance criteria we will use in this paper. We 
start with the model we use for the fingerprinting and attack 
processes. 

A. Mathematical model 

A content owner has a host signal that he wishes to share, 
but he wants to mark it with fingerprints before distributing. 
We view this host signal as a vector s E M.^ , and the marked 
versions of this vector will be given to M > N users. 
Specifically, the mth user is given 

where G denotes the mth fingerprint. We assume the 
fingerprints have equal energy: 
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(2) 



that is, Df denotes the average energy per dimension of each 
fingerprint. 

We wish to design the fingerprints {fni\m=i to be robust 
to a linear averaging attack. In particular, let /C C {1, . . . , Af} 
denote a group of users who together forge a copy of the host 
signal. Then their linear averaging attack is of the form 

y =^OLk{s + fk) + ^ Q!fe = 1, (3) 

keK keK 

where e is a noise vector introduced by the colluders. We 
assume e is Gaussian noise with mean zero and variance Na"^, 
that is, (7^ is the noise power per dimension. The relative 
strength of the attack noise is measured as the watermark- 
to-noise ratio (WNR): 



WNR := lOlogio f 



ND 



(4) 



V Na^ 

This is analogous to signal-to-noise ratio. See Figure [T] for a 



schematic of this attack model. 



B. Detection 



Certainly, the ultimate goal of the content owner is to detect 
every member in a forgery coalition. This can prove difficult in 
practice, though, particularly when some individuals contribute 
little to the forgery, with a^, <C 1. However, in the real world, 
if at least one colluder is caught, then other members could 
be identified through the legal process. As such, we consider 
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Fig. 1. The fingerprint assignment ^ and forgery attack js} processes. 



focused detection, where a test statistic is computed for each 
user, and we perform a binary hypothesis test for each user to 
decide whether that particular user is guilty. 

With the cooperation of the content owner, the host signal 
can be subtracted from a forgery to isolate the fingerprint 
combination; 

2; := ^ afe/fc + e- 

keK 

We refer to X^feeAC ^kfk as the noiseless fingerprint combi- 
nation. The test statistic for each user m is the normalized 
correlation function: 

Tm{z) ■■= -\{z, f,n}, (5) 
T 

where 7^ is the fingerprint energy (|2]i. For each user m, let 
Hi{m) denote the guilty hypothesis (to e K.) and Ho{m) 
denote the innocent hypothesis (to ^ K,). Letting r denote a 
correlation threshold, we use the following detector: 



Hi{m), Tyn{z) > T, 
Ho{m), T,n{z) < T. 



(6) 



To determine the effectiveness of our fingerprint design and 
focused detector, we will investigate the corresponding error 
probabilities. 

C. Error analysis 

Due in part to the noise that the coalition introduced to the 
forgery, there could be errors associated with our detection 
method. One type of error we can expect is the false-positive 
error, whose probability is denoted Pj, in which an innocent 
user TO (to ^ /C) is found guilty (T„i{z) > r). This could 
have significant ramifications in legal proceedings, so this error 
probability should be kept extremely low. The other error type 
is the false-negative error, whose probability is denoted Pn, in 
which a guilty user (to G JC) is found innocent {T^iz) < t). 
The probabilities of these two errors depend on the fingerprints 
F = {/m}m=i' the coalition /C, the weights a = {akjkeic, 
the user to, and the threshold t: 

Pi(F,TO,r,/C,a) :=Prob[T™(z) > r|i?o(m)], 
Pii(F,TO,r,/C,a) ::= Prob[T,„(z) < T\Hi{m)]. 



We will characterize the worst-case error probabilities over all 
possible coalitions and users. 

We first define the probability of a "false alarm": 

Pfa(F, T, /C, a) := maxPi(F, m, T, /C, a). (7) 

This is the probability of wrongly accusing the innocent user 
who looks most guilty. Equivalently, this is the probability of 
accusing at least one innocent user. The worst-case type I error 
probability is given by 

Pi(F,T,a) :=maxPfa(F,r,/C,a). (8) 
/c 

Next, consider the probability of a "miss": 

Pm{F,T,IC,a) :— min Pn(i^, to, r, /C, a). 

This is the probability of not accusing the most vulnerable 
guilty user. Equivalently, this is the probability of not detecting 
any coUuders. Note that this event is the opposite of detecting 
at least one colluder: 

Pd(F,T,/C,a) := 1-P„,(F,T,/C,a). (9) 

The worst-case type II error probability is given by 

Pii(F,T,a) := maxPm(F,r,/C,a). (10) 

K 

The worst-case error probability is the maximum of the two 
error probabilities (|8]l and ( [TO] i: 

Pe(F, T, a) max {Pi(F, r, a), Pii(F, r, a)}. 

The threshold parameter t can be varied to minimize this 
quantity, yielding the minmax error probability: 



Pminmax(^', a) minPo(F, T, a). 



(11) 



In Section IV we will analyze these error probabilities. We 
will also investigate average-case performance using simula- 
tions in Section [V] 

D. Geometric figure of merit 

Related to the error probabilities is an important geometric 
figure of merit. For each user to, consider the distance between 
two types of potential collusions: those of which m is a 
member, and those of which to is not. Intuitively, if every 
noiseless fingerprint combination involving to is distant from 
every fingerprint combination not involving to, then even with 
moderate noise, there should be little ambiguity as to whether 
the TOth user was involved or not. 

To make this precise, for each user to, we define the "guilty" 
and "not guilty" sets of noiseless fingerprint combinations: 

^ ^/fe :me/CC{l,...,Af},|/C|<if 



A. :m^/CC{l,...,Af},|/C|<if 



In words, Qrn'^ is the set of size-i^ fingerprint combinations 
of equal weights (a^ — j^) which include to, while ^Q. 
is the set of combinations which do not include to. Note that 
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in our setup (|3]l, the a^'s were arbitrary nonnegative values 
bounded by one. We will show in Section IV that the best 
attack from the collusion's perspective uses equal weights 
(ak — so that no single colluder is particularly vulnerable. 
For this reason, we use equal weights to obtain bounds on the 
distance between these two sets, which we define to be 



dist(c;(„^),^t;(f)) 

min{||x - yh : x eOl^Ky E^GI^''}. 



(12) 



In Section [III] we find a lower bound on this distance. 

Another related parameter is the worst-case coherence, 
which is the largest inner product between any two distinct 
fingerprints: 

/z := max|(/,,/j)|. (13) 

Intuitively, we want this value to be small, as this would 
correspond to having the fingerprints spaced apart. In the 
following section, we discuss a way of designing fingerprints 
which we will later evaluate using the above criteria. 

III. ETF Fingerprint Design 

In this section, we introduce a fingerprint design based 
on equiangular tight frames (ETFs). We will discuss some 
important properties of ETFs and use them to determine a 
lower bound on the distance ^V2\ from our geometric figure 
of merit. But first, we consider the fingerprinting problem from 
a compressed sensing viewpoint. 

A. Compressed sensing viewpoint 

We wish to design fingerprints in a way that will enable us to 
identify the small group of users who take part in a collusion. 
To do this, we consider a matrix-vector formulation of the 
attack (|3]l without noise, i.e., with e = 0. Specifically, let F 
denote the x M matrix whose columns are the fingerprints 
{/m}m=i' ^^'^ '^he M X 1 vector a denote the weights 
used in the collusion's linear average. Note that is zero if 
user m is innocent, otherwise it's given by the corresponding 
coefficient in ([3]l. This gives 

z = Fa. 

Using this representation, the detection problem can be in- 
terpreted from a compressed sensing perspective. Namely, a 
is a A'-sparse vector that we wish to recover Under certain 
conditions on the matrix F, we may "sense" this vector with 
N < M measurements in such a way that the AT-sparse vector 
is recoverable: 



Theorem 1 ( ]36) ). Suppose an N x M matrix F satisfies the 
restricted isometry property (RIP): 

(1 - S2K)\\a\\l < \\Fa\\l < (1 + S2k)\H\1 (14) 

for every 2K-sparse vector a € M*^, where 62K < \/2 — 1. 
Then for every K-sparse vector a G M*^, 

a — argmin subject to Fa — Fa. 

Thus, if F satisfies RIP ( [T4| , we can recover the AT-sparse 
vector a £ by linear programming. For the attack model 



with adversarial noise, z — Fa + e, if F satisfies RIP ( [T4) l, 
linear programming will still produce an estimate a of the 
sparse vector [37|. However, the distance between a and a 
will be on the order of 10 times the size of the error e. 
Due to potential legal ramifications of false accusations, this 
order of error is not tolerable. Note that these methods (both 
for the noiseless and noisy cases) recover the entire vector 
a; equivalently, they identify the entire collusion. That said, 
we will investigate RIP matrices for fingerprint design, but to 
minimize false accusations, we will use focused detection ^ 
to identify colluders. 

B. Geometric figure of merit for RIP matrices 

We now investigate how well RIP matrices perform with 
respect to our geometric figure of merit. Without loss of 
generality, we assume the fingerprints are unit norm; since they 
have equal energy 7^, the fingerprint combination z can be 
normalized by 7 before the detection phase. With this in mind, 
we have the following a lower bound on the distance ([12]) 
between the "guilty" and "not guilty" sets corresponding to 
any user m: 



Theorem 2. Suppose fingerprints F = [/i , 
the restricted isometry property ( |14| l. Then 



dist(& 



> 



2K 



K{K -1) 



, /m] satisfy 



(15) 



Proof Take /C, /C' C {1, . . . , M} such that |/C|, |/C'| < K 
and m G JC\JC' . Then the left-hand inequality of the restricted 
isometry property ([14]) gives 

1 1 ^ 



meic 



\JC'\ ^ 



meIC' 



(\K.\ |/c'|)X/'^'" ^ ^ 



\ic\. 



|/C'|H- 



>(i-W'i)(l^n/c'|(^-pi^)%^ 
= ^^^(|/c| + n-2|/cn/c'|). 

For a fixed |/C|, we will find a lower bound for 

1 .^„\ . |/c| -2|/cnr| 



|/c| 



|/c| + |/c'|-2|/cn/c'| =1 



|/C'| 



(16) 



(17) 



I'ci 



we know ' ' |^,| < 



Since we can have |/Cn/C'| > 

when ^TT) is minimized. That said, |/C'| must be as small 
as possible, that is, |/C'| = |/C n /C'|. Thus, when ([17]) is 
minimized, we must have 



|/C| 



|A:| + |/c'|-2|A:n/c'| 



1^1 
|/cn/C'| 



1, 



i.e., |/C n /C'l must be as large as possible. Since m e /C \ K,', 
we have |/C n /C'| < |/C| - 1. Therefore, 



1 



|/c| + |/c'|-2|/cn/c'| > 



1 



(18) 
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Substituting ([TSj into ( fTSj l gives 



\K\Y1 



fm 



\ic'\ 



frr 



> 



J\KUK'\ 



> 



•2K 



|/C|(|/C|-1) - K{K^1)- 



Since this bound holds for every to, IC and IC' with m G JC\K.' , 
we have ( [T5] l. ■ 
Note that ( [T5] l depends on (52k, and so it's natural to ask 
how small 52k can be for a given fingerprint design. Also, 
which matrices even satisfy RIP ([T4]i? In general, we say F 
is {K, (5)-RIP if for every X-sparse vector x. 



< 



\Fx\\l < {l + 6)\\x\\ 



Proving that a given matrix F is {K, 5) -RIP involves calcu- 
lating eigenvalues of all size-K submatrices, which is com- 
putationally difficult for large matrices. The following lemma 
makes this explicit: 

Lemma 3. The smallest 6 for which F is {K,S)-RIP is 

max \\F*F^-lKh- (19) 



max 

/CC{1,...,M} 
\IC\=K 



Proof: We first note that F being (if, 5)-RIP trivially 
implies that F is {K, S + e)-RIP for every e > 0. It therefore 
suffices to show that (i) F is {K, (5min)-RIP, and (ii) F is not 
{K, (5)-RIP for any S < (5min- To this end, pick some K-spaise 
vector X. To prove (i), we need to show that 



(l-5min)||a;|P < \\Fx\\^ < {1 + 6nun)\\x\\' 



(20) 



Let JC C {!,..., M} be the size-K support of x, and let xjc 
be the corresponding subvector Then rearranging (|20]i gives 



> 



- 1 



,{F^F^-Ik)-. 



(21) 



Since, by definition, 5^\n maximizes ( [ST) over all supports JC 
and entry values xk., the inequality necessarily holds; that is, F 
is necessarily (A', (5,„in)-RIP. Furthermore, equality is achieved 
by the support JC which maximizes ([19]) and the eigenvector 
xx, corresponding to the largest eigenvalue of F^F/c — Ik'-, 
this proves (ii). ■ 
Since calculating eigenvalues for all size-K submatrices 
is computationally difficult, the Gershgorin circle theorem is 
often used to obtain a coarse bound in demonstrating RIP: 

Theorem 4 (Gershgorin circle theorem f38l). Take a K x K 
matrix A. Then for each eigenvalue A of A, there exists an 
i G {!,..., K} such that X lies in the complex disk centered 
at An of radius l^ijl- 

This leads to the following well-known bound on 62K in 
terms of worst-case coherence: 

Lemma 5. Given a matrix F with unit-norm columns, then 

62K < {2K - (22) 
where /i is the worst-case coherence ( |13| l. 

Proof: From Lemma [3] the optimal d2K is 

S2K ■■= max \\F^Fic -Ik\\2- 

ICC{1 A/} ^ 



In words, given an ensemble of fingerprints, we consider 
each subcollection of size 2K, subtract the identity from their 
2K X 2K Gram matrix and calculate the largest eigenvalue; the 
largest eigenvalue we find over all subcollections is what we 
call S2K- Since the fingerprints have unit norm, every Gram 
matrix of 2K fingerprints will have ones on the diagonal, and 
the absolute values of the off-diagonal entries will be no more 
than /i. Therefore, by applying the Gershgorin circle theorem 
(Theorem [4]i to d2K, we obtain ( p2] i. ■ 
Combining Theorem |2] and Lemma |5] yields a coherence- 
based lower bound on the distance between the "guilty" and 
"not guilty" sets corresponding to any user to: 

Theorem 6. Suppose fingerprints F — [/i, . . . , are unit- 
norm with worst-case coherence ^. Then 



dist(e\-e^)> 



ll-{2K-l)iJ 
K(K-l) ■ 



(23) 



We would like /i to be small, so that the lower bound ( |23| ) 
is as large as possible. But for a fixed N and M, the worst- 
case coherence of unit-norm fingerprints cannot be arbitrarily 
small; it necessarily satisfies the Welch bound p9): 



> 



I M-N 
N{M - 1)' 



Equality in the Welch bound occurs precisely in the well- 
studied case where the fingerprints form an equiangular tight 
frame (ETF). An equiangular tight frame is a N x M matrix 
which has orthogonal rows of equal norm and unit-norm 
columns whose inner products have equal magnitude |40|. 

One type of ETF has already been proposed for fingerprint 
design: the simplex pO) . The simplex is an ETF with AI = 
iV + 1 and ^ = In fact, |j20j gives a derivation for the 
value of the distance ( [T2] l in this case: 



dist(a 



(K) 



1 



M 



K{K - 1) A/ - 1 ' 



(24) 



The bound ([23]) is lower than ([24| by a factor of - 
and for practical cases in which K ^ N, they are particularly 
close. Overall, ETF fingerprint design is a natural generaliza- 
tion of the provably optimal simplex design of ||20j. 



C. Existence of RIP matrices 

We now discuss the existence of RIP matrices as well as 
the construction of a specific class of ETFs. Given the RIP 
definition ( [T4] i, it might not be clear how many matrices 
satisfy this condition. Surprisingly, RIP matrices are abun- 
dant; for any S2K, there exists a constant C such that if 
N > CK\og{M/K), then matrices of Gaussian or Bernoulli 
(±1) entries satisfy RIP with high probability. However, as 
mentioned in the previous section, checking if a given matrix 
satisfies RIP is computationally difficult. 

Fortunately, there are some deterministic constructions of 
RIP matrices, such as pT) , P2) . However the performance, 
measured by how large K can be, is not as good as the 
random constructions; the random constructions only require 
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F = 



V3 



+ 



- - + 



Fig. 2. The equiangular tiglit frame constructed in Example [T] 



N — il.{K\og'^ M), while the deterministic constructions 
require N = n{K'^). The specific class of ETFs additionally 
requires M < |40). 

Whether N scales as K versus is an important 
distinction between random and deterministic RIP matri- 
ces in the compressed sensing community. However, this 
difference offers no advantage for fingerprinting. Ergun et 
al. showed that for any fingerprinting system, a collusion of 
K = 0(^7V/lniV) is sufficient to overcome the fingerprints 
pS) . This means with such a K, the detector cannot, with 
high probability, identify any attacker without incurring a 
significant false-alarm probability Pfa (|7]i. This constraint 
is more restrictive than deterministic ETF constructions, as 
^TV/ In N < \/N < N/log^M. Consequently, random 
RIP constructions are no better for fingerprint design than 
deterministic constructions. 

Ergun's bound indicates that with a large enough K, col- 
luders can overcome any fingerprinting system and render our 
detector unreliable. We now show that if K is sufficiently 
large, the colluders can exactly recover the original signal s: 

Lemma 7. Suppose the real equal-norm fingerprints {fk\k£K 
do not lie in a common hyperplane. Then s is the unique 
minimizer of 



E 

keK 



\\^-is+fk)\\ 



k'eK 



\\x-is+fk')\\ 



Proof: Note that g{x) > 0, with equality precisely when 
\\x — (s + /fe)|p is constant over k E JC. Since the /^'s have 
equal norm, g{s) = 0. To show that this minimum is unique, 
suppose g{x) = for some x ^ s. This implies that the values 
\\x — {s + fkjW^ are constant, with each being equal to their 
average. Moreover, since 

Ik + fkW = \\^- 4^ - 2(a: - s, fk) + ll/fcf , 

we have that {x — s, fk) is constant over k E JC, contradicting 
the assumption that the fingerprints {fk}keK do not lie in a 
common hyperplane. ■ 



D. Construction of ETFs 

Having established that deterministic RIP constructions are 
just as good as random constructions for fingerprint design, we 
now consider a particular method for constructing ETFs. Note 
that ETFs are notoriously difficult to construct in general, but 
a relatively simple approach was recently introduced in | [42) . 
The approach uses a tensor-like combination of a Steiner 
system's adjacency matrix and a regular simplex, and it is 



general enough to construct infinite families of ETFs. We 
illustrate the construction with an example: 

Example 1 (see |42|). To construct an ETF, we will use 
a simple class of Steiner systems, namely (2,2,v)-Steiner 
systems, and Hadamard matrices with v rows. In particular, 
(2, 2, v)-Steiner systems can be thought of as all possible pairs 
of a v-element set f[43^ , while a Hadamard matrix is a square 
matrix of ±Vs with orthogonal rows / [43| /. 

In this example, we take v — A. The adjacency matrix of 
the {2,2, A)-Steiner system has (2) = 6 rows, each indicating 
a distinct pair from a size-A set: 



A 



(25) 



To be clear, we use "+/—" to represent ±1 and an empty 
space to represent a value. Also, one example of a 4 x A 
Hadamard matrix is 



H = 



- + - 



(26) 



We now build an ETF by replacing each of the "+" entries 
in the adjacency matrix \25) with a row from the Hadamard 
matrix ( |26| l. This is done in such a way that for each column 
of A, distinct rows of H are used; in this example, we use 
the second, third, and fourth rows of H. After performing this 
procedure, we normalize the columns, and the result is a real 
ETF F of dimension N = 6 with M = 16 fingerprints (see 
Figure [2]). 

We will use this method of ETF construction for simu- 
lations in Section [V] Specifically, our simulations will let 
the total number of fingerprints M range from 2N to 7N, 
a significant increase from the conventional iV + 1 simplex 
and N orthogonal fingerprints. Note, however, that unlike 
simplex and orthogonal fingerprints, there are limitations to 
the dimensions that admit real ETFs. For instance, the size 
of a Hadamard matrix is necessarily a multiple of 4, and the 
existence of Steiner systems is rather sporadic. Fortunately, 
identifying Steiner systems is an active area of research, with 
multiple infinite families already characterized and alternative 
construction methods developed p2), |[44). 
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IV. Error Analysis 

A. Analysis of type I and type II errors 

We now investigate the worst case errors involved with 
using ETF fingerprint design and focused correlation detection 
under linear averaging attacks. Recall that the worst-case type 

I error probability ([8]) is the probability of falsely accusing the 
most guilty-looking innocent user. Also recall that the worst- 
case type II error probability ([TOjl is the probability of not 
accusing the most vulnerable guilty user. 

Theorem 8. Suppose the fingerprints F — {/m}m=i form an 
equiangular tight frame. Then the worst-case type I and type 

II error probabilities, ([8]l and satisfy 



Vi{F,T,a)<Q 
Pii(i^,T,a) <Q 



( ((1 + /^) max afe-/i) - r ) 



where Q{x) :— e " ^'^du and ^ 



M-N 
N{M-1)- 



Proof: Under hypothesis Ho{m), the test statistic for the 
detector (|6| is 



\neK 



^ a„(±/x) -t-e', 



neK 

where e' is the projection of noise e/7 onto the normed vector 
frail, and, due to symmetry of the variance of e in all di- 
mensions, e' ^ A/'(0, Ij^). Thus, under hypothesis HQ{m), 
T^{m) 7V(X]„gyc '^^/t^)- subtract the 

mean and divide by the standard deviation to obtain; 



Prob[T™(^) > r|Ho(m)] = Q 



7 



<Q{l{r~^l}). 



\nelC 



(27) 



Note that Q{x) is a decreasing function. The bound ( p7] i is 
obtained by setting all of the coefficients of the coherence to 
be positive. 

Likewise, under hypothesis Hi{m), the test statistic is 



Tjm) = 



"2 ( X! ""/"+^' /" 



^ \neK I 

+ X! "n(±M) + e'- 

nGK\{m} 



Thus, under hypothesis iJi(m), 
T,(m) -AA 



n£K\{m} ^ I 



Since 1 — Q(x) = Q{—x), the type 11 error probability can be 
bounded as 



Prob[T„(z) <t] = Q 
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< 



VCT 



We can now evaluate the worst-case errors (|8]l and ( fTO] ). For 
type I errors, with m ^ JC: 

Pi(F, T, a) = max max Pi (F, TO, T, /C, a) 

= maxmaxProb \Tm{z) > T\Ho{m)] 
7 

< maxmax(5( — (r — //)). 

= Q(^(r-A^)). 

For type II errors, 

Pii(F, T, a) — max min Pii(i^, to, r, /C, a) 
= max min Prob [Tm{z) < t] 

K m^K 

7 

< max min Q(-([a„i(l + fi) - fj] - r)) 

/C me/C (T 

7 

= Q(-([maxa„i(l + A^) - m] - t)). 

(J m^K 

The last equation follows since once the as are fixed, the 
actual coalition K, does not matter. ■ 
We can further maximize over all possible weightings a: 

Pi(F,t) ^ maxPi(F,T,a) 

Q 

<Q{l{T-fl)) 

Pii(F,t)= maxPii(F,T, a) 

a 

< inaxQ( — ([maxa„i(l + /i) — /i] — r)) 

= (5(-([minmaxam(l + M) "M]-'^)) 

= Q(-([^(l+M)-M]-r)). 

Thus, the vector a which minimizes the value of its maximum 
element is the uniform weight vector This motivates the 
attackers' use of a uniformly weighted coefficient vector a 
to maximize the probability that none of the members will be 
caught. 



B. Minimax error analysis 

From a detection standpoint, an important criterion is the 
minimax error probability ( [TT] i. The threshold t trades off type 

I and type II errors. Thus, there is a value of t, denoted 
by T*, which minimizes the maximum of the probabilities 
of the two error types. Since the bound for the type I error 
probability is independent of a, and the bound for the type 

II error probability is maximized with a uniform weighting, 
assume this to be the case. 
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Theorem 9. The minmax probability of error can be 
bounded as: 



Q 



low 

2 



< P 



mmmax 



up 

2 



(28) 



where 



a^K{K-l) 



d* 

"up 



./WW} 



aK 



Note that for orthogonal and simplex fingerprints, the min- 
max errors are both of the form 



mininax 



d*{K) 
2 



For orthogonal fingerprints pO | 

d*{K) 



aK 



which is better than dl^^{K) (the Q function is decreasing). 
For simplex fingerprints, d*{K) is slightly better than both 
(20): 

^^)= aK M-l 

Proof: The lower bound is the sphere packing lower 
bound |24|. For the upper bound, 

Pe{F, r, a) = max{P/(F, r, a),Pii{F, r, a)} 

<max{g(^(T~A^)),Q(^([l(l+/i)-/i]-r))}. 
a a K 

Since the test statistic Tz{m) is normally distributed with the 
same variance under either of the hypotheses HQ{m) and 
Hi{m), the value of r that minimizes this upper bound is 
the average of the means fi and — ji, namely r* :— 
Using this r* and recalling (|2]i, we have 



mmmax 



(F,a) = minPc(i^,r,a) = Pc(F,T*,a) 



2aK 
0«p(if)/2) 



Consider the regime where N is large, M grows linearly 
or faster than N, and WNR is constant (in particular 0, so 



D 



f 



a^). Then [i sa 



"low 



K 



and d; 



up 



N ( 2K 

7^ 



N 

~k' 



- 2. 



If K ^ vN, then both bounds go to infinity so 
Pminmax(^, a) — > 0. Also, the gcomctric figure of merit ([12]) 
then behaves as 



distfg. 



m 1 



1 



Ndl 



If K is proportional to v^, then Pminmax(^, a) is bounded 
away from 0. 

We can also compute the error exponent for this test: 
e(F,T*,a) :=-lim ^ hiPe(F, r*, a). 
Corollary 10. // M ^ N ^ K^, then the error exponent is 



e{F,T*,a) 



1 

8K^' 



(29) 



Proof: The proof follows by applying the asymptotic 
equality In Q{t) ^ — ^ as t — )• oo to the bounds in ( |28] l. 
The bounds are asymptotically equivalent. ■ 
Note that this error exponent is the same as in the simplex 



case 1 20 1. As K ^ oo, the error exponent d29b goes to zero 



V. Simulations 

In Section |IV[ the worst-case error probabilities were ana- 
lyzed, where the worst case was over all collusions. Here we 
investigate average case behavior We examine the probability 
of detecting at least one guilty user, Pd (|9]), as a function of 
K with the false-alarm Pfa ([7]) fixed below a threshold. The 
threshold can be interpreted as the (legally) allowable limit 
for probability of false accusation. We compare the average 
case performance of ETF fingerprints, simplex fingerprints 
(201, ™d orthogonal fingerprints | ,16 | for four dimension sizes 
N e {195, 651, 2667, 8128}. The ETF construction described 
in Example [T] was used. The results demonstrate that ETF 
fingerprints perform almost as well as both orthogonal and 
simplex fingerprints, while accommodating several times as 
many users. We now describe the design of the simulations. 

A. Design 

For a fixed signal dimension size N, ETF, orthogonal, and 
simplex fingerprints were created. The ETF fingerprint design 
was constructed using the method shown in Example [T] For 
N — 195, a (2, 7, 91)-Steiner system was used |j44|, yielding 
M = 1456 fingerprints. For TV = 651 and N = 2667, the 
Steiner systems were constructed using projective geometry, 
with M = 2016 and M = 8128 respectively g2|. For 
N = 8128, a (2, 2, 2^)-Steiner system was used, giving 
M = 16, 384 fingerprints (42l. 



The orthogonal fingerprint design was constructed using 
an identity matrix. For actual embedding, the orthogonal 
fingerprints should be randomly rotated to ensure difficulty in 
removing them. One method to achieve this is to randomly 
generate i.i.d. Gaussian vectors in N dimensional space, 
orthogonalize them, then scale them to have the same energy 
(r6| . For detection purposes, however, rotations of the basis 
vectors are inconsequential. 

The simplex fingerprint design was constructed using the 
following method of sequentially fixing the values of the fin- 
gerprints in each dimension. The vectors of a regular simplex 
are equidistant from the center, having the same power, and 
have inner products equal to — |j45j . Letting the first vector 
have a one in the first row and zeros in the other rows forces 
every other vector's first element to be — ^ to satisfy the inner 
product constraint. For the second vector, choose its second 
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element to satisfy the power constraint and set the elements of 
the remaining rows to zero. Using the inner product constraint, 
we can find the value of the second element for all other 
vectors. Repeating these steps constructs a regular simplex. 

Linear collusion attacks were simulated separately for the 
different designs and collusion sizes K. For each attack, K 
of the M fingerprints were randomly chosen and uniformly 
averaged. Next, an i.i.d. Gaussian noise vector was added with 
per-sample noise power ct^ — Df, corresponding to a WNR 
Q of dB {]9\. 

The test statistics Tz{m) ^ were then computed for each 
user TO. For each threshold r, it was determined whether there 
was a detection event (at least one colluder with Tz{m) > r) 
and/or a false alarm (at least one innocent user with Tz{m) > 
t). In total, 50,000 attacks were simulated, and the detection 
and false alarm counts were averaged. Then the minimal t 
value was selected for which Pfa < 10^^. This induced the 
corresponding P^. 

B. Results 

We ran experiments with four different dimension sizes 
N e {195,651,2667,8128}. The noise level was kept at 
WNR = dB. The value of K varied between 1 and suffi- 
ciently large values so approached zero. Plots for the prob- 
ability of detection P^ as a function of the size of the coalition 
K are shown in Figures |3}|6] for N e {195, 651, 2667, 8128} 
respectively. The largest values of K for which at least one 
attacker can be caught with probability (nearly) one under 
the Pfa constraint are about 2, 5, 11, and 21 respectively. 
Overall, ETF fingerprints perform comparably to orthogonal 
and simplex fingerprints while accommodating many more 
users. 
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Fig. 3. A plot of the probability of detecting at least one colluder (Pj) as a 
function of the number of colluders (K). The threshold r is picked to be the 
minimum threshold to fix Pf^ < 10~^. The WNR is dB and N = 195. 
The (maximum) number of fingerprints were 195 for the orthogonal, 196 for 
the simplex, and 1456 for the ETF construction. 



Fig. 4. A plot of the probability of detecting at least one colluder (Pd) as a 
function of the number of colluders (K). The threshold r is picked to be the 
minimum threshold to fix Pj^ < 10"^. The WNR is dB and N = 651. 
The (maximum) number of fingerprints were 651 for the orthogonal, 652 for 
the simplex, and 2016 for the ETF construction. 




Fig. 5. A plot of the probability of detecting at least one colluder (Pj) as a 
function of the number of colluders (K). The threshold r is picked to be the 
minimum threshold to fix Pfa < 10"^. The WNR is dB and N = 2667. 
The (maximum) number of fingerprints were 2667 for the orthogonal, 2668 
for the simplex, and 8128 for the ETF construction. 



Fig. 6. A plot of the probability of detecting at least one colluder (Pd) as a 
function of the number of colluders (K). The threshold r is picked to be the 
minimum threshold to fix Pfa < 10"^. The WNR is dB and N = 8128. 
The (maximum) number of fingerprints were 8128 for the orthogonal, 8129 
for the simplex, and 16, 384 for the ETF construction. 
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